Sensitive medical records dumped in public Allentown recycling bin

EMILY OPILO / THE MORNING CALL

Patient records from Women's Health Consultants on Pond Road in South Whitehall Township were found in a bin at the Allentown Recycling Center. The Morning Call redacted information from this photograph so no personally identifiable information is visible.

Patient records from Women's Health Consultants on Pond Road in South Whitehall Township were found in a bin at the Allentown Recycling Center. The Morning Call redacted information from this photograph so no personally identifiable information is visible. (EMILY OPILO / THE MORNING CALL)

“Patient has a history of herpes,” read a sheet in one file, with a woman’s name, date of birth and other identifying information clearly visible at the top. “High risk HPV,” read another that also conspicuously listed a name, address and birth date. Pages just beneath those revealed Social Security numbers, scanned images of driver’s licenses and cancer histories.

The dumped files, discovered in August during a routine drop-off at the center on Martin Luther King Jr. Drive, were medical records. That was clear to the tipster who reported the finding to the city and alerted The Morning Call.

In a publicly accessible area of the recycling center, a reporter located the records that Saturday, Aug. 12. About a dozen files appeared to have been dumped, exposing not only personal information that could be used to commit identity theft but sensitive medical histories that health care workers are forbidden to share.

It’s illegal under the federal medical privacy law — the Health Insurance Portability and Accountability Act commonly known as HIPAA — to dispose of medical records in a publicly accessible trash or recycling bin unless they have been rendered unreadable or indecipherable, according to the U.S. Department of Health and Human Services website.

The records at the Allentown recycling center were more haphazardly discarded, the person who came upon them noted in an anonymous email to The Morning Call.

“I just went to Atown recycling center to drop off recycling and noticed several giant garbage bags in the blue office paper dumpsters overflowing with medical records from some OB GYN office in Allentown and Bethlehem,” the person wrote. “Completely unsecured!! And nothing shredded.”

(EMILY OPILO / THE MORNING CALL)

Medical records from Women's Health Consultants on Pond Road in South Whitehall were found in a dumpster in August at the Allentown Recycling Center. The Morning Call redacted information from this photograph so no personally identifiable information is visible.

Medical records from Women's Health Consultants on Pond Road in South Whitehall were found in a dumpster in August at the Allentown Recycling Center. The Morning Call redacted information from this photograph so no personally identifiable information is visible. ((EMILY OPILO / THE MORNING CALL))

It’s unclear who dumped the records in the bin. City spokesman Mike Moore said there was no video surveillance of the container where the records were found.

Nearly all the visible records were printed on letterhead from Women’s Health Consultants, a now-closed practice that operated at 1611 Pond Road in South Whitehall Township and 5325 Northgate Drive in Hanover Township, Northampton County.

A Lehigh County woman whose name is on one of the sheets was shocked to hear the news from a reporter.

“It’s one thing if it’s a family doctor, but when it’s your gynecology records,” she said.

The woman was a patient of Dr. Zirka Halibey and last visited the office more than four years ago.

“You hear of things being breached on the internet and you can see that,” she said. “There’s no excuse to take paperwork and throw it in the dumpster.”

Halibey, who now works at Sacred Heart Healthcare System, was as “surprised and upset as anyone that someone would be careless with any medical records,” said Barbara Wood, Sacred Heart spokeswoman.

Halibey was a part-time employee of the practice, she added, and “would have had nothing to do with the control over the charts.”

Dr. Deborah Villeneuve, whose name also turns up on Women’s Health Consultants’ paperwork in the bin, said in a voicemail message left in response to The Morning Call’s questions that she had not been with Women’s Health Consultants for several years and had no access to records there. She referred questions to Dr. Gazi Abdulhay.

The Morning Call was unable to reach Abdulhay, who is identified in public records as having various roles with the practice.

He signed annual registration certificates filed by Women’s Health Consultants with the Pennsylvania Department of State in 2009, 2010 and 2011, covering calendar years 2006 through 2010. The 2010 filings identify Abdulhay as president of Women’s Health Consultants. There were no filings after 2011, according to department spokeswoman Kaitlin Murphy.

Abdulhay is identified as owner of “Womans” Health Consultants on a 2013 state tax lien filed against him and the practice, and as “mbr” on a federal tax lien filed against “Womens” Health Consultants in 2014. He is identified as medical director on Women’s Health Consultants’ listing in the National Provider Identifier database, an online medical directory managed by the U.S. Centers for Medicare & Medicaid Services. The practice’s listing was last updated in 2012.

In court records filed in 2015 in response to a lawsuit, Abdulhay denied being an “agent, servant and/or employee” of Women’s Health Consultants and denied practicing there.

The Morning Call was unable to find a working home phone number for Abdulhay. He did not respond to a note left at a North Whitehall Township residence that Lehigh County records show he owns. A certified letter sent there was not claimed, according to the post office.

Abdulhay joined Crozer-Keystone Health System as chief of gynecologic oncology last year, according to a news release published on the system’s website in December 2016. He did not return a call to his phone number listed in the health system’s directory, or to a certified letter sent to him at Crozer-Keystone in Upland, Delaware County.

The three former Women’s Health Consultants physicians whose names appeared on the found files said they had no access to the files or knowledge of how the files were disposed of.

“As outlined in my employment agreement with Women’s Health Consultants, LLC, all patient records were the property and responsibility of my employer,” Dr. Gayllyn Faust-Rakos said in a statement issued through her current employer, Coordinated Health. “I was prohibited from retaining patient files, records, lists and other documents following the conclusion of my employment with the company in 2010, and I have had no contact with the organization since. I would be sincerely disappointed if there has been any mishandling of patient records …, and I work vigilantly to protect the privacy rights of my patients every day.”

(EMILY OPILO / THE MORNING CALL)

Medical records from Women's Health Consultants on Pond Road in South Whitehall were found in a bin in August at the Allentown Recycling Center. The Morning Call redacted information from this photograph so no personally identifiable information is visible.

Medical records from Women's Health Consultants on Pond Road in South Whitehall were found in a bin in August at the Allentown Recycling Center. The Morning Call redacted information from this photograph so no personally identifiable information is visible. ((EMILY OPILO / THE MORNING CALL))

In the anonymous tip, the person who came upon the records in the recycling bin said they reported it to the Allentown communication center’s non-emergency line.

“They are supposed to send someone out to check it out,” the tipster said in the email. “Hope they do something.”

Moore said a city employee went to the recycling center that Saturday and “pushed the sensitive documents so that they were buried and no longer visible to the public.”

The following Monday, the recycling container, which is 25 yards long and about 4½ feet deep, was loaded onto a truck parked at the city’s yard waste center until it could be transported to a recycling company in Philadelphia, Moore said. The public then had no access to the truck or its contents, which were covered with a tarp, he said.

Allentown’s recycling center has a separate locked bin for people who want to recycle confidential documents, Moore said.

Under HIPAA, medical facilities must have a plan for the disposal of medical records. While no particular method is required, the law allows shredding, burning, pulping or pulverizing paper records, according to the Department of Health and Human Services’ website. That site notes it is not permissible to dump medical records in public areas unless they have been rendered “essentially unreadable, indecipherable and otherwise cannot be reconstructed.”

Violators can face fines of $100 for unintentional violations up to $50,000 for “willful neglect,” according to the website. State attorneys general have the right to punish HIPAA violators with civil actions in federal court, with damages of up to $25,000 possible.

The Pennsylvania attorney general’s office investigates HIPAA complaints, spokesman Joe Grace said, but couldn't say if the Allentown case was under investigation because the office doesn’t confirm the existence of any investigations, as a matter of policy. He said people can file a complaint with the office’s health care section at 877-888-4877 or attorneygeneral.gov.

MEDICAL RECORDS DISPOSAL

According to the U.S. Department of Health & Human Services, methods to properly dispose of private health information in paper files include:

Shredding or otherwise destroying paper records so that the information is rendered essentially unreadable, indecipherable and otherwise cannot be reconstructed before placing it in a dumpster or other trash receptacle.

Maintaining information for disposal in a secure area and using a disposal vendor as a business associate to pick up and shred or otherwise destroy the information.

In justifiable cases, based on the size and the type of the covered entity, and the nature of the private health information, depositing information in locked dumpsters that are accessible only by authorized persons, such as appropriate refuse workers.